fix(csp): add jspreadsheet logo to CSP

[MaciekBaron]

What is the context of this PR?

This MR addresses CMS 1336 and adds a URL to the jspreadsheet logo to our CSP, so that it does not get rejected upon loading.

Note even though the ticket uses http:// in the URL, only the https:// version was added – my understanding is that we shouldn't be loading content over http in any scenario, and therefore the CSP rejecting it is a good thing.

How to review

Ensure that tests pass.

Deployment Safety

Bleed and Sandbox deploy automatically on merge, so PRs should be safe to deploy immediately.

Please select one:

• Safe to auto-deploy
• Not safe to auto-deploy

Follow-up Actions

Potentially consider only adding this to the CSP when necessary and not on every page load.

---

Ticket: CMS-1336

[helenb]

I only see the CSP error in my local build intermittently, but when I do it is for an http version:

So I'm not sure if this change addresses the issue.

I notice we allow *.hotjar.com - does that mean http is already allowed for that domain?

[MaciekBaron]

@helenb I wonder if this is because the image is referenced using //bossanova.uk/jspreadsheet/logo.png which means it uses the same protocol as the page itself (so if you're using http://localhost:8000 it would use http)?

[helenb]

@helenb I wonder if this is because the image is referenced using //bossanova.uk/jspreadsheet/logo.png which means it uses the same protocol as the page itself (so if you're using http://localhost:8000 it would use http)?

You're right - just tested in sandbox and the path it reports uses https.